How to get a PlayFab secret key for Zendesk and lock it down

To get a PlayFab secret key for Zendesk, open your title in PlayFab Game Manager, click the gear icon, then Title settings > Secret Keys > New Secret Key. Name it "Zendesk Questwell", set an expiration date, save and copy the key. Paste it into Questwell's Title secret key setting with your title id, then turn on the key's IP allowlist with Zendesk's egress ranges.

Why a key of its own

A PlayFab title secret key with no API allowlist can call every Admin and Server API in a title. A key made only for Zendesk is one you can expire, disable, allowlist or limit to certain APIs without touching the key your game servers use. Every change to it shows in PlayStream as a secret key changed event.

Steps

1. Create the key. Game Manager > your title > gear icon > Title settings > Secret Keys > New Secret Key. Enter the name "Zendesk Questwell" and an expiration date, for example 12 months out. Save and copy the key.
2. Note the title id. It is the short code under the title name, letters and digits only, for example A1B2C.
3. Install Questwell from the Zendesk Marketplace and start the 14-day trial.
4. Fill in two settings. PlayFab title id takes the short code, not a URL; anything else is refused and nothing is sent. Title secret key takes the key.
5. Open a ticket from a player to check the sidebar loads.
6. Turn on the IP allowlist (next section).

Where the key lives

Lock the key to Zendesk's IP ranges

PlayFab lets each secret key carry its own IP allowlist. With it on, Server and Admin calls made with the key are accepted only from the addresses on the list, so a copy of the key fails anywhere else.

1. Open https://<your-subdomain>.zendesk.com/ips and copy the ranges under egress.
2. In Game Manager, go to Title settings > Secret Keys, edit the "Zendesk Questwell" key and toggle Enable IP allowlist.
3. Paste the ranges, one per line, and select Save.
4. Refresh the Questwell sidebar on a ticket.

If the sidebar says PlayFab refused the request from Zendesk's address, remove the allowlist and email hello@greatwork.company so the addresses for your Zendesk region can be checked with you. PlayFab warns that an incorrect entry blocks every address not on the list; that is why a dedicated key matters, since your game servers keep working on their own key. PlayFab's steps are on its secret key management page.

Rotate the key before it expires

1. Create a new key the same way, with a new expiration date.
2. Paste it into Questwell's Title secret key setting.
3. Check a ticket.
4. Disable the old key in Game Manager.

Optional: limit the key to the APIs Questwell calls

PlayFab can also give a secret key an API allowlist: calls to any API not on it return HTTP 403 (NotAuthorized). Edit the key, turn on Enable API allowlist, use Search APIs to select each one, then save and confirm. Changes take effect as PlayFab's key caches expire, not instantly.

Leave an action's API off and that action fails with a "PlayFab refused the request" message, while the rest of the sidebar keeps working.

Optional: a title-wide API policy

Your title's API Access Policy can deny calls such as /Admin/DeletePlayer for every key, if your own servers never use them. That affects the whole title, so it is a decision for your team. Questwell doesn't read or change the policy, and delete calls aren't in the app at all.

What it costs

Questwell has two plans with every feature: Team at $99 a month per Zendesk account for up to 12 agents and admins, and Scale at $8 per agent per month from 13. There is a 14-day free trial, Zendesk asks for a card at install, and Zendesk bills it monthly. The full settings list is in the Questwell documentation.